What to Know

  • A Coldcard hardware wallet vulnerability has prompted some bitcoin holders to move coins onto exchanges for perceived short term safety.
  • The pattern contrasts with the aftermath of FTX’s collapse in late 2022, when investors withdrew large amounts of bitcoin from centralized platforms into self custody.
  • Daily exchange deposits of bitcoin transfers under 10 BTC rose to 7,300 BTC on July 31, the highest level since Feb. 6, according to CryptoQuant data cited by market researchers.
  • Daily active bitcoin addresses increased from 645,000 on July 30 to almost one million on July 31, the highest since Dec. 10, 2024.
  • Transfers smaller than 1 BTC reached 39,600 BTC on Friday, close to the 39,900 BTC moved on November 16, 2022, the day after FTX filed for bankruptcy.
  • On chain observers estimate losses from the Coldcard incident at 1,000 to 1,300 BTC, roughly $70 million to $90 million, across more than 1,000 addresses.
  • Total net inflows to exchanges reached 11,163 BTC on July 31, with funds moving into major platforms and firms including Binance, River, Kraken, and OKX.
  • Bitcoin held in wallets tied to centralized exchanges rose to 2.715 million BTC from 2.703837 million BTC before the Coldcard exploit.
  • The incident appears specific to Coldcard rather than a broad failure of all hardware wallets or self custody systems.

Bitcoin Holders Reverse the Post FTX Playbook

The Coldcard hardware wallet exploit has triggered an unusual on chain reaction: some bitcoin holders are moving coins back to centralized exchanges. That marks a sharp reversal from the dominant market behavior seen after the FTX collapse in late 2022, when the primary fear centered on exchange insolvency, withdrawal freezes, and counterparty risk. At that time, many investors pulled coins from trading venues and shifted them into self custody, including hardware wallets and personal storage setups.

This time, the perceived risk is different. The current concern is not focused on a failing exchange but on a vulnerability tied to a Bitcoin only hardware wallet. As a result, some holders appear to be treating exchanges as temporary shelters while they assess wallet security, seed phrase exposure, and the operational steps needed to move funds into fresh custody arrangements. FXCOINZ market coverage finds that the behavior is concentrated heavily among smaller bitcoin transfers, indicating that retail holders and smaller wallet users may be reacting most quickly.

Blockchain analytics firms have pointed to a notable rise in exchange deposits, daily active addresses, and small transfer volumes. The movement does not necessarily suggest broad confidence in centralized exchanges. Instead, it reflects a practical decision by some users facing uncertainty around a specific self custody tool. When investors worry that a wallet seed may have been generated with insufficient randomness, speed and accessibility can become more important than custody ideology.

What Happened With Coldcard

Coldcard, a Bitcoin only hardware wallet made by Canadian firm Coinkite, is facing one of its most serious security incidents after a firmware bug reportedly weakened how some devices generated seed phrases. The issue involved a fallback from the device’s hardware random number generator to a predictable software random number generator when creating new wallets. That reduced the entropy of certain seed phrases, potentially allowing attackers to reconstruct likely seeds offline and derive private keys without physically accessing the device.

The thefts began on Friday, July 30, and have continued in waves since. On chain analysts have tracked multiple exploits, with losses estimated at 1,000 to 1,300 BTC, or roughly $70 million to $90 million, across more than 1,000 addresses. Some of the largest bursts moved hundreds of BTC in under an hour, and researchers have indicated that the attacks may be ongoing as of this writing.

The flaw is understood to date back to March 2021. Because seed phrases are the foundation of wallet security, any weakness in their randomness can become highly consequential. A hardware wallet’s core promise is that it helps users generate and protect private keys in a controlled offline environment. If the generation process itself is weakened, an attacker may not need to steal the device, compromise a computer, or trick a user into signing a transaction. The danger can exist at the level of the seed phrase.

The episode has prompted wider debate in the crypto market about the safety of hardware wallets and self custody. Prominent industry figures, including Binance founder CZ, have publicly reflected on the risks associated with hardware wallet assumptions. Still, the incident is specific to Coldcard, and market participants have not treated it as evidence that all self custody systems or hardware wallets have failed. Properly generated seed phrases and unaffected devices remain outside the direct scope of the vulnerability.

Exchange Deposits Show a Clear Safety Response

The most visible on chain shift has been the movement of bitcoin into exchange wallets. CryptoQuant data cited by market researchers shows that daily exchange deposits of bitcoin transfers under 10 BTC rose to 7,300 BTC on July 31. That was the highest level since Feb. 6 and stood out because it came as users reacted to the Coldcard exploit rather than to an exchange level crisis.

Julio Moreno, head of research at CryptoQuant, said the spike could be related to the Coldcard hack, with people moving holdings in search of safety. He also noted that daily active addresses jumped from 645,000 on July 30 to almost one million on July 31, the highest since Dec. 10, 2024. Most of the increase came from addresses sending coins to exchanges, suggesting that the activity was not merely normal network churn but a targeted custody response.

For technical traders and on chain analysts, the composition of the flows matters. Transfers under 10 BTC are typically viewed as a useful window into smaller holder behavior, even though wallet labels and ownership structures can be complex. In this case, the data points to caution among users who may hold meaningful personal balances but are not necessarily large institutional custodians or whales.

The reaction highlights a practical truth about bitcoin custody. Self custody reduces dependence on exchanges, but it also transfers responsibility to the holder. Users must manage seed generation, backups, device integrity, firmware updates, inheritance planning, and operational security. When one of those assumptions is challenged, especially seed generation, some users may prefer the immediate simplicity of a reputable exchange while they determine their next step.

Small Transfers Approach Post FTX Levels

Small bitcoin transactions tell a similar story. According to CryptoQuant, the combined volume of all transfers smaller than 1 BTC reached 39,600 BTC on Friday. That was just below the 39,900 BTC moved on November 16, 2022, the day after FTX filed for bankruptcy. The comparison is striking because the two events produced opposite custody reactions.

After FTX failed, the market’s dominant conclusion was that coins left on exchanges carried serious counterparty risk. The phrase often repeated across the industry was that users should control their own keys. Exchange balances declined as investors moved bitcoin into wallets where they could personally manage private keys. The Coldcard episode complicates that simple narrative by showing that self custody is not a single risk free category. It is a spectrum of tools, procedures, and trust assumptions.

Moreno described the recent movement as evidence that smaller bitcoin users had not moved this amount of BTC in a day since the FTX collapse. He also said he liked seeing people taking action. That sentiment captures the defensive character of the flows. The transfer activity does not necessarily indicate panic selling or a broad bearish shift in bitcoin demand. Rather, it appears to reflect users rearranging custody in response to a perceived security threat.

Blockchain sleuth Timechainindex made a similar observation, identifying total net inflows to exchanges of 11,163 BTC on July 31. The inflows reportedly went mostly into major exchanges and firms such as Binance, River, Kraken, and OKX. The account described the inflows as coming from scared smaller holders, reflecting the anxiety created by uncertainty over whether particular wallets or seed phrases could be at risk.

Exchange Balances Rise After the Exploit

The total amount of bitcoin held in wallets tied to centralized exchanges has increased since the Coldcard incident became visible on chain. The balance rose to 2.715 million BTC from 2.703837 million BTC before the exploit. That increase aligns with the exchange deposit surge and supports the idea that some holders are temporarily prioritizing liquid, accessible custody over offline storage.

Exchange balance changes are closely watched because they can influence market interpretation. Rising exchange balances sometimes raise concerns about potential selling pressure, as coins on exchanges are easier to trade. However, in this case, the context is essential. The inflows are linked to a custody security event rather than a clear directional market call. Some users may move coins to exchanges only long enough to create new wallets, transfer to unaffected devices, or review best practices.

Market participants are therefore likely to separate custody driven deposits from sell side deposits. A bitcoin holder moving funds to an exchange for safety is not necessarily preparing to liquidate. At the same time, once coins are on exchange platforms, they become more immediately available for trading, margin activity, or conversion. That means analysts will continue watching whether the elevated balances persist or begin to reverse after users complete their security checks.

Why This Is Not Another FTX Moment

The contrast with FTX is central to understanding the current market reaction. FTX represented a failure of a centralized exchange, which made self custody look safer by comparison. The Coldcard incident involves a specific self custody device and a seed generation vulnerability, which makes some users view centralized exchanges as a short term alternative. The direction of bitcoin flows has flipped because the perceived source of danger has flipped.

That does not mean centralized exchanges have become risk free, and it does not mean self custody has lost its role in bitcoin ownership. Instead, it shows that custody risk is situational. Exchange risk, hardware risk, seed phrase risk, user error, malware exposure, and operational mistakes can all matter at different times. Bitcoin holders often choose among imperfect options based on which risk feels most urgent.

The incident also underscores the importance of wallet transparency, firmware review, independent security research, and cautious seed management. For users who rely on hardware wallets, the key question is not only whether a device stores keys offline, but whether the seed creation process was sufficiently random and trustworthy. When that confidence is shaken, even committed self custody users may take temporary defensive action.

For now, the available on chain data shows a measurable shift toward exchanges among smaller bitcoin holders. The move is notable because it runs against one of the strongest post FTX market narratives. Yet it remains tied to a specific incident rather than a wholesale rejection of self custody. FXCOINZ will continue watching whether exchange balances remain elevated or whether funds move back into newly secured wallets once users regain confidence.

Frequently Asked Questions (FAQs)

What is the Coldcard exploit?

The Coldcard exploit refers to a vulnerability affecting some Coldcard hardware wallets, where a firmware bug reportedly weakened seed phrase generation by causing affected devices to use a predictable software random number generator instead of the hardware random number generator.

How much bitcoin has been lost in the incident?

On chain analysts estimate losses at 1,000 to 1,300 BTC, roughly $70 million to $90 million, across more than 1,000 addresses. The attacks have occurred in multiple waves, and researchers have said they may be ongoing as of this writing.

Why are bitcoin holders moving coins to exchanges?

Some holders appear to be moving bitcoin to exchanges because they view them as a temporary safety option while they assess whether their self custody setup, wallet seed, or hardware device may be exposed to risk from the Coldcard vulnerability.

How is this different from the FTX collapse?

After FTX collapsed in late 2022, investors withdrew bitcoin from exchanges because the main fear was centralized platform failure. In the Coldcard incident, the concern is tied to a specific hardware wallet, so some users are moving coins in the opposite direction, back onto exchanges.

What did the on chain data show?

CryptoQuant data showed that daily exchange deposits of bitcoin transfers under 10 BTC rose to 7,300 BTC on July 31, while daily active addresses increased from 645,000 on July 30 to almost one million on July 31.

Are small bitcoin holders the main group reacting?

The available data suggests that smaller holders are a major part of the reaction. Transfers under 1 BTC reached 39,600 BTC on Friday, close to the 39,900 BTC moved on November 16, 2022, the day after FTX filed for bankruptcy.

Does this mean all hardware wallets are unsafe?

No. The incident is specific to Coldcard and does not represent a broad failure of all hardware wallets or all self custody methods. Most hardware wallets and properly generated seed phrases remain unaffected by this particular vulnerability.

Do exchange inflows mean holders are selling bitcoin?

Not necessarily. Exchange inflows can sometimes indicate potential selling pressure, but in this case the flows appear closely linked to custody concerns. Some users may be moving funds temporarily while they create new wallets or review security steps.

What should bitcoin holders take from this event?

The main lesson is that custody choices involve trade offs. Self custody reduces reliance on exchanges, but users still depend on secure seed generation, device integrity, backups, and careful operational practices. The safest approach depends on understanding the specific risks involved.

Photo by Alesia Kozik on Pexels